First, I have a private delegate set up on my web site for OpenID and pointed my SE account at the URL on my web site; SE has no knowledge of the actual OpenID provider endpoint until my delegate response tells it.
Second, when authenticating to SE et al I note that if I don't explicitly key in https://... it makes the request using HTTP instead of HTTPS.
Third, having associated my SE account with my OpenID endpoint, I am able to use either HTTP or HTTPS to login, despite using HTTPS when the account was associated.
Does this not, therefore, open me up to a MIM attack whereby the attacker simply modifies the response from my web server to delegate to their own malicious OpenID "provider", thereby gaining access to my SE account?
Note: I am not talking about the actual authentication step with the OpenID provider, which does use HTTPS and redirects to HTTPS if accessed via HTTP, I am talking about the initial request from SE to my delegate, which SE allows to be done using HTTP because they only store the URL from the base domain onwards (omitting both the protocol and the subdomain) to use for matching up to an account instead of the full URL.